Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

An open source, general-purpose policy engine.

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

Prowler is a security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains all CIS controls listed here https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf and more than 100 additional checks that help on GDPR, HIPAA and other security requirements.

InSpec: Auditing and Testing Framework

Wazuh - The Open Source Security Platform

🔒🌍 Static analysis powered security scanner for your terraform code

Configuration guidance for implementing the Windows 10 and Windows Server 2016 DoD Secure Host Baseline settings. #nsacyber

Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.

Security automation content in SCAP, OSCAL, Bash, Ansible, and other formats

Plugin for sudo that requires another human to approve and monitor privileged sudo sessions

🔎 ScanCode detects licenses, copyrights, package manifests & dependencies and more by scanning code ... to discover and inventory open source and third-party packages used in your code.

a lightweight, security focused, BDD test framework against terraform.

Detect threats with log data and improve cloud security posture

NIST Certified SCAP 1.2 toolkit

The GDPR Checklist

Compliance automation framework, focused on SOC2

Symmetric Encryption for Ruby Projects using OpenSSL

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.

A suite of tools to assist with reviewing Open Source Software dependencies.

Continuous Auditing & Configuration

A common framework enabling companies to work together to protect consumers' privacy and data rights.

Wazuh - Ruleset

Library and CLI tool for analysing CloudFormation templates and check them for security compliance.

List of DNS violations by implementations, software and/or systems

A small Ruby Gem to run RSpec and Serverspec, Infrataster and Capybara tests against Dockerfiles or Docker images easily.

macOS Security Compliance Project

Wazuh - Docker containers

Wazuh - Kibana plugin